Customers of cryptocurrency exchange Binance withdrew approximately $3.6 billion in digital assets after the platform resumed transactions following a cyberattack involving an estimated $6.3 billion.
The world’s largest cryptocurrency exchange disclosed that it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 6:00am and 3:30pm GMT on Sunday, November 1, resulting in a net outflow of about $3.64 billion.
Binance said withdrawals initially surged after services resumed but later declined and began to stabilise. The company noted that the net outflow represented slightly more than two per cent of the $171 billion in assets under its management.
The exchange also said it had replaced approximately 95 per cent of the assets stolen during the breach, adding that it was working to source the outstanding amount. It maintained that it would bear the full financial impact of the incident.
Binance had earlier announced that it reserved more than $6.3 billion to address the consequences of the attack. Withdrawals of more than two dozen major cryptocurrencies, including Bitcoin and Ethereum, have resumed, while other services are expected to return in phases following security checks.
However, efforts to recover the stolen funds remain ongoing. Alec Zebrick, a senior manager in global services at blockchain analysis firm Chainalysis, said the attackers were still actively moving the assets through cryptocurrency networks.
He explained that the funds were being distributed across thousands of wallet addresses and deposits in an apparent attempt to conceal their movement. Chainalysis is working with Binance and government authorities to trace and recover the stolen assets.
The attack has been linked to TraderTraitor, a North Korean cybercrime group also known as the Lazarus Group. The group was previously linked to the theft of $1.5 billion from cryptocurrency exchange Bybit in 2025.
The United States Federal Bureau of Investigation (FBI) published a list of cryptocurrency wallet addresses associated with the group on Saturday and urged industry operators to block transactions connected to them. Binance subsequently called on cryptocurrency issuers to freeze affected assets.
Preliminary investigations by Binance suggested that the breach may have originated from an engineer’s compromised laptop, which allegedly gave hackers access to a route for executing unauthorised transactions. Subsequent findings reportedly identified additional points through which the attackers gained access.
The incident, which occurred on October 29, affected Binance’s global centralised exchange, Binance.com. Its United States-facing platform was not affected, according to the company.
The reported $6.3 billion loss would make the incident the largest cryptocurrency theft on record, surpassing the $1.5 billion stolen from Bybit in 2025. Reports indicated that most of the funds were taken from Binance’s transaction-processing wallets within a period of about 20 minutes.
Binance, founded in China, has hundreds of millions of registered users worldwide.
